What is the CVSS score of CVE-2026-12079?

CVE-2026-12079 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Dokan Pro CVE-2026-12079

EUVD-2026-39165 MEDIUM

SQL Injection (CWE-89)

2026-06-25 Wordfence

GHSA-r6wq-h383-2vw2

WordPress SQLi Dokan Pro Wedevs

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, low complexity, Subscriber-level auth required (PR:L); purely a read/exfiltration flaw with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 04:31 vuln.today

CVE Published

Jun 25, 2026 - 03:42 nvd

MEDIUM 6.5

DescriptionCVE.org

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL injection in the Dokan Pro WordPress plugin allows network-accessible authenticated attackers with Subscriber-level privileges to extract sensitive data from the underlying WordPress database. The flaw resides in the 'orderby' parameter, which is insufficiently escaped and passed into unparameterized SQL queries across all plugin versions through 5.0.4. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - any registered subscriber - substantially widens the realistic attacker pool on marketplace and multi-vendor WordPress sites.

Technical ContextAI

Dokan Pro (CPE: cpe:2.3:a:wedevs:dokan_pro:*:*:*:*:*:*:*:*) is a premium WooCommerce multi-vendor marketplace plugin developed by weDevs. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical SQL injection weakness class. The root cause is a dual failure: user-supplied input to the 'orderby' URL/request parameter is not properly escaped or sanitized, and the SQL query itself lacks parameterized preparation (e.g., via WordPress's $wpdb->prepare()). The time-based technique indicates the injection is blind - an attacker infers database contents by observing server response delays caused by injected SQL timing functions (e.g., SLEEP()), allowing data exfiltration without direct error output. The CVSS vector (AV:N/AC:L) confirms the vulnerable endpoint is reachable over the network with no special conditions beyond authentication.

RemediationAI

The primary remediation is to update the Dokan Pro plugin to a version beyond 5.0.4; however, no exact patched release version was confirmed in the provided input data - administrators should consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf95020-ac4f-4fb2-8fb4-a9998005991c?source=cve) and the official Dokan changelog at https://dokan.co/ to identify the current fixed release and apply it immediately. As a compensating control if patching is delayed, site administrators should restrict new user self-registration to limit the attacker pool, or elevate the minimum role required to access the vulnerable 'orderby' parameter endpoint. Web Application Firewall (WAF) rules targeting SQL injection patterns in the 'orderby' parameter can provide partial coverage but should not substitute for patching. Note that time-based SQLi may partially evade naive WAF signatures, so signature-based controls alone are insufficient. Disabling the Dokan Pro plugin entirely is the most effective temporary mitigation but will remove marketplace functionality.